Why Was Coinbase Fined? Inside Ireland's €3.25m Safeguarding Penalty

Why was Coinbase fined? The short answer

Coinbase was fined because its Irish e-money subsidiary did not protect customer funds in the way Irish and EU law requires, and did not have the local expertise or governance to notice and fix the problems itself. The Settlement Notice dated 21 October 2026 records that Coinbase Ireland Limited (referred to by the regulator as CBIE) agreed the facts and admitted four prescribed contraventions of the Electronic Money Regulations 2011:

• Outsourcing (Regulation 22(2)). From 1 November 2020 to 16 December 2024, CBIE outsourced its safeguarding processes to Coinbase Inc. in the United States without the local skill, expertise or oversight to control them.
• Mixing of funds (Regulation 29(2)(a)(i)). From 1 November 2020 to 19 August 2025, CBIE customer money was mixed with funds of Coinbase Inc. and of the group's UK e-money firm.
• Failure to safeguard (Regulation 29(2)(a)(ii)). Until October 2024, customer funds were not always held in the designated safeguarding account, which was underfunded every day for at least 18 months.
• Failure to notify (Regulations 18 and 31). From 1 November 2020 to 17 January 2024, CBIE did not tell the Central Bank about material changes to the safeguarding model it had described when it applied for authorisation.

The Central Bank set the penalty at €4,646,597 and applied the maximum 30% settlement discount, bringing it to €3,252,618, alongside a formal reprimand. Coinbase Ireland has accepted the sanctions, but they only take effect once the High Court confirms them. Coinbase said in a statement reported by CoinDesk that no customer suffered any financial loss and no customer was ever unable to access their funds, and the regulator itself found no evidence that customer detriment was actually realised. The case is about the risk that would have crystallised had the firm failed, and about the regulator's insistence that promises made at authorisation are kept.

Who is Coinbase Ireland and what does an e-money institution do?

Coinbase Ireland Limited is an electronic money institution: a firm licensed to issue digital money in exchange for ordinary currency and to redeem it on demand. According to the Settlement Notice, the Central Bank authorised CBIE in October 2019 and it began operating on 1 November 2020. It is a wholly owned subsidiary of Coinbase Global, Inc., the US-listed group that runs one of the world's largest crypto asset trading platforms.

CBIE does not itself buy or sell crypto assets. Its role is to take customers' euro, sterling or dollar deposits, issue e-money against them, and let customers use that e-money to buy crypto assets on the group's platform through other Coinbase companies. Customers can also sell crypto back into e-money and hold it with CBIE. The firm passports its services across the European Economic Area, which is the commercial point of an Irish licence: authorisation in Dublin opens the whole EEA market.

Two facts from the notice show the scale. When the United Kingdom left the EU, over 6.3 million customers migrated from the group's UK e-money firm, CB Payments Limited, to CBIE in 2020. And the amounts CBIE was obliged to safeguard averaged €323 million in 2023 and €470 million in 2024. Until 31 December 2025 the group also ran two Irish virtual asset service providers, Coinbase Europe Limited and Coinbase Custody International Limited. Under the EU's crypto-asset regime those registrations lapsed, and the notice records that the group moved Coinbase Europe's business to a Luxembourg entity authorised as a crypto-asset service provider, so the group no longer runs a crypto-asset service provider from Ireland. Our guide to MiCA licence requirements and passporting explains how that regime works. The e-money business, and therefore this case, stayed in Ireland.

What safeguarding customer funds means under the Electronic Money Regulations 2011

Safeguarding means keeping customers' money legally and practically separate from the firm's own money, so that it can be returned in full if the firm fails. It is the core consumer protection for e-money, because an e-money institution is not a bank and its customers do not have deposit insurance on their balances.

Regulation 29 of the European Communities (Electronic Money) Regulations 2011, which implement the EU E-Money Directive in Ireland, gives firms two ways to safeguard "users' funds", meaning money received in exchange for e-money issued:

• Segregation. Users' funds must not be mixed at any time with the funds of anyone other than the e-money holders on whose behalf they are held, and any funds still held at the end of the business day after receipt must be deposited in a separate account at a credit institution or invested in secure, low-risk assets accepted by the Central Bank.
• Insurance or guarantee. Alternatively, users' funds can be covered by an insurance policy or a guarantee from a credit institution outside the firm's own group, payable if the firm cannot meet its obligations, for the amount that would otherwise have been segregated.

CBIE used the segregation method, with a designated safeguarding account at AS LHV Pank, a bank in the EEA. Regulation 29(4) is what makes this matter: no liquidator, receiver, administrator, examiner or creditor of the firm has any claim on properly segregated users' funds. If the account is short, or if customer money sits in an account in someone else's name, that protection weakens exactly when it is needed. Readers familiar with UK practice will recognise the logic from what happens when a company goes into administration: an insolvency office-holder deals with the assets in the company's name, and ring-fenced client money is the exception.

The Central Bank had been warning the sector for years. Its "Dear CEO" letter of 20 January 2023 reported that one in every four payment and e-money firms had self-identified deficiencies in their safeguarding frameworks, noted that users' funds safeguarded by the sector had risen by over 700% to €7.56 billion by the end of September 2022, and required firms to obtain a specific audit of their safeguarding compliance. It also said, in words the regulator repeated on 22 October, that the Central Bank has no tolerance for weaknesses in safeguarding arrangements.

Outsourcing to the US parent: the breach the Central Bank called reckless

The most serious finding was that CBIE handed its safeguarding function to a group company in the United States and did not keep the people or structures in Ireland to oversee it. The Central Bank classed this contravention as reckless, and the other three as negligent.

Under the group's shared services model, CBIE outsourced to Coinbase Inc. the operation of its safeguarding controls, the daily reconciliation of the safeguarding account, the reporting system used to calculate how much had to be safeguarded, the calculation itself and the daily rebalancing of funds. The Central Bank's on-site inspection, which began in May 2024, found that the people overseeing safeguarding and the outsourced service were employees of other Coinbase companies based outside Ireland, and that even the second and third line testing of those controls was outsourced to Coinbase Inc.

Regulation 22(2) of the 2011 Regulations prohibits outsourcing important operational functions in a way that materially impairs the firm's internal control or the Central Bank's ability to supervise it. The regulator's Cross-Industry Guidance on Outsourcing makes the point directly: while the performance of functions can be outsourced, boards and senior management cannot outsource their responsibilities. The same guidance expects firms to apply the same rigour to intragroup arrangements as to external providers, because group outsourcing can carry the same risks.

What made this reckless, in the Central Bank's view, was the warning history. The regulator wrote to CBIE on 14 July 2022 about significant governance deficiencies and issued a risk mitigation programme, then reissued it with extended deadlines on 27 March 2023 because the risks had not been mitigated. CBIE did not appoint a safeguarding directly responsible individual until 16 December 2024. The case is a reminder that the choice between operating through a branch or a subsidiary abroad is only the start: a licensed subsidiary must have real substance where it is licensed.

Mixed funds: Silvergate, Signature and the Brexit legacy accounts

The second contravention is that CBIE customers' money ended up in accounts held in the names of other Coinbase companies, which Regulation 29 treats as mixing, whatever the internal ledgers showed. The notice describes two separate routes.

The first began during the US banking turmoil of March 2023. Until then, CBIE's US dollar institutional customers paid into a CBIE account at Silvergate Bank, and the money was swept to the safeguarding account in the EEA by the end of the next business day. On 2 March 2023, ahead of Silvergate's failure, CBIE told 30 institutional customers to pay instead into a Coinbase Inc. "for benefit of" account at Signature Bank. When Signature failed on 12 March 2023, they were redirected to a Coinbase Inc. account at Cross River Bank. Neither account was in CBIE's name. The practice ran for about 19 months, until CBIE opened its own settlement account at Customers Bank in October 2024.

CBIE argued the money was protected by customer ledgering, "for benefit of" status, US deposit insurance and its own custodial calculations. The Central Bank's answer was that the no-mixing rule is absolute and admits no such exceptions.

The second route stemmed from Brexit. Some of the customers who moved from Coinbase UK to CBIE in 2020 kept paying into the UK firm's safeguarding account despite email and in-app reminders, so CBIE customers' money sat with an entity outside the EU. CBIE notified the regulator on 17 January 2024 and began rejecting those deposits from 15 March 2024. Internal audit later found that 33 customers could still pay into the UK account because of how they had been onboarded, and the route was only closed for everyone on 19 August 2025. That is why the breach period runs for almost five years. According to RTÉ, Coinbase said the breaches largely arose from steps taken to protect customers during major disruption, pointing to the 2023 banking crisis and to customers who continued using legacy UK accounts.

An underfunded safeguarding account: the Looker report and the shortfall

The third contravention is that the money in CBIE's designated safeguarding account did not match what it owed customers, because the system used to calculate the obligation was wrong for more than two years. This is the finding with the hardest numbers.

CBIE worked out its daily safeguarding obligation using a report built in Looker, a business intelligence tool, drawing on the group's customer ledgers and records of which Coinbase entity each customer contracted with. In July 2022 a change to the data tables behind that report left it incomplete. The notice calls this the Timing Mismatch Issue. CBIE spotted it in January 2024 but thought it affected only currencies its customers did not use; the inspection found it affected all currencies and both retail and institutional customers. The result:

• the safeguarding account was underfunded every day from 1 January 2023 to 27 June 2024;
• the maximum daily shortfall was €3.4 million in 2023 and €5.2 million in 2024;
• the average daily shortfall was 0.54% of the safeguarding obligation, which averaged €323 million in 2023 and €470 million in 2024.

Two further failures compounded it. Between September 2023 and June 2024, some unallocated customer receipts did not appear in the report at all, because control checks were not completed when a new banking provider was brought in. And until 19 January 2024, euro withdrawals by customers of Coinbase UK and Coinbase Inc. were paid out of CBIE's safeguarding account, which usually held most of the group's euros. CBIE topped up the shortfall immediately when it was identified in late June 2024, and fixed the underlying issues in October 2024. The Central Bank's point was that, had CBIE become insolvent during the period, the account would not have held enough to meet its obligations.

Promises made at authorisation: the failure to notify

The fourth contravention is that CBIE changed how its safeguarding worked without telling the Central Bank, even though the regulator had authorised it on the basis of a different design. Regulation 18 requires an e-money institution to inform the Central Bank without undue delay of any change affecting the accuracy of its authorisation application, and Regulation 31 requires advance written notice of material changes to safeguarding measures.

In its application CBIE said customer funds would be safeguarded in a single segregated account used for receipt, safeguarding and settlement, and that all transactions affecting its safeguarding obligation, and the reconciliation itself, would be automated with manual intervention only by exception. In practice its safeguarding bank would not accept US dollar deposits directly into the EEA account, so dollar deposits went first to CBIE accounts in the US; around 30 institutional customers were routed through Coinbase Inc. accounts; and the process relied on significant manual intervention in some cases. None of this was notified until January 2024.

The regulator's Director of Enforcement, Karen O'Leary, singled this out. In the Central Bank's announcement she said details and commitments given during authorisation are critical to the decision whether to authorise a firm, and that failing to adhere to those assurances or to report material changes "is completely unacceptable". For any group using an Irish licence as its EU gateway, that is the sentence to circulate to the board.

How the €3.25m Coinbase Ireland fine was calculated

The Central Bank calculated the Coinbase Ireland fine by applying the seven-step method in its Administrative Sanctions Procedure Guidelines, published in December 2023, and the Settlement Notice shows every step.

Step	What the Central Bank did	Result
1. Starting point	CBIE's average annual gross turnover over the breach period (1 November 2020 to 19 August 2025), rounded	€63,219,000
2. Severity	Severity level 7 on a scale of 1 to 10, so 7% of the starting point	€4,425,330
3. Aggravating and mitigating factors	One aggravating factor: failure to complete two risk mitigation programmes (July 2022 and March 2023); plus 5%	€4,646,597
4. Further adjustment	No other relevant considerations	€4,646,597
5. Maximum penalty check	Cap is the greater of 10% of annual turnover or €10 million; here €10 million	No adjustment
6. Totality	A reprimand alone would not be enough; no totality adjustment	€4,646,597
7. Settlement discount	Maximum 30% discount under the undisputed facts settlement process	€3,252,618

Several things drove the severity level of 7. The regulator stressed that CBIE breached safeguarding in three distinct ways, which it read as a systemic weakness, that the breaches lasted a combined 57.5 months, that CBIE departed from published guidance it had been told directly to follow, and that safeguarding failures damage public confidence in the whole e-money sector. The absence of actual customer loss did not reduce the fine: the regulator weighed the potential for detriment had the firm failed.

The 30% discount is the most a firm can get under the undisputed facts process, where the facts are agreed early enough to make an investigation unnecessary. Other regulators use similar levers: the UK's Competition and Markets Authority gave the full 40% settlement discount in the Wayfair consumer law fine last week. Groups should also check how any penalty is treated for tax; in the UK, for example, the Supreme Court has just confirmed in the ScottishPower ruling on fines and penalties that regulatory penalties are not deductible.

Timeline of the Coinbase Ireland safeguarding breaches

The breaches overlapped, started at different times and ended at different times. The Settlement Notice lists the duration of each, which the table below brings together.

Breach	Period	Duration
Mixing of funds through Coinbase UK accounts	November 2020 to August 2025	57.5 months
Outsourcing failures	November 2020 to December 2024	49 months
Failure to notify the Central Bank	November 2020 to January 2024	38 months
Timing Mismatch Issue (underfunding)	July 2022 to October 2024	27 months
Mixing of funds through Coinbase Inc. accounts	March 2023 to late 2024	19 months
Unallocated Funds Issue	September 2023 to June 2024	9 months

The supervisory history runs alongside. CBIE's board attested on 31 March 2022 that the firm complied with its safeguarding obligations. An external safeguarding audit required by the January 2023 letter produced 20 findings on oversight, controls, access and segregation. CBIE notified three safeguarding issues in January 2024, the on-site inspection started in May 2024, a further risk mitigation programme followed in January 2025 and was closed in June 2026 after third-party assurance, and the enforcement investigation began in July 2025. The settlement was reached on 21 October 2026 and announced the next day.

Settlement, High Court confirmation and what happens next

The fine is agreed but not yet in force: under Irish law, a sanction agreed through the undisputed facts settlement process must be confirmed by the High Court before it takes effect. The Central Bank said it will apply for confirmation as soon as practicable after the settlement.

The test is narrow. According to the Central Bank's notes and its sanctions guidelines, the High Court will confirm the sanction unless it is satisfied that it is manifestly disproportionate. If it does not confirm it, the matter goes back to the Central Bank and the firm to reconsider, with any recommendation from the court. Precedent suggests confirmation is the usual outcome: the High Court confirmed the sanctions agreed with Coinbase Europe on 12 January 2026, about two months after that settlement. Firms that may face a confirmation hearing, or want to understand the procedure, can consult dispute resolution lawyers in Ireland.

On the regulatory side, the remediation is already largely done. CBIE appointed a safeguarding lead in December 2024, fixed the calculation issues in October 2024, opened its own US settlement account and blocked the legacy UK route in August 2025, and the January 2025 risk mitigation programme was closed in June 2026. According to RTÉ, Coinbase said it had strengthened its safeguarding controls, redesigned its calculation processes and added dedicated expertise. The reprimand will, however, sit on the firm's record, and the Central Bank treats previous enforcement history as a relevant factor if further breaches arise.

A second Coinbase sanction and a wider enforcement pattern

This is the Central Bank's second enforcement action against a Coinbase company in under a year. On 6 November 2025 it fined Coinbase Europe Limited €21,464,734 for anti-money laundering failures between 23 April 2021 and 19 March 2025. In that case, faults in its transaction monitoring system meant 30,442,437 transactions, worth over €176 billion and about 31% of its transactions in the period, were not properly monitored, and 2,708 suspicious transaction reports were later filed. That was the Central Bank's first enforcement outcome in the crypto sector.

Case	Coinbase Europe Limited	Coinbase Ireland Limited
Announced	6 November 2025	22 October 2026
Licence type	Virtual asset service provider (registration since lapsed)	Electronic money institution
Law breached	Criminal Justice (Money Laundering and Terrorist Financing) Act 2010	Electronic Money Regulations 2011
Core failure	Transaction monitoring	Safeguarding, outsourcing and notification
Fine after 30% discount	€21,464,734	€3,252,618
Central Bank enforcement outcome number	162nd	164th

The Coinbase Ireland case is the Central Bank's 164th enforcement outcome, taking its total fines to over €432 million, and the fifth settlement under the procedure as enhanced by the Central Bank (Individual Accountability Framework) Act 2023. The common thread with Coinbase Europe is not crypto risk as such but control failures in a fast-growing group whose systems were built centrally. That theme runs through financial enforcement elsewhere too, as our analysis of the Bank of America AML and sanctions penalties shows. Groups now relocating crypto activity under MiCA, as Coinbase did to Luxembourg, may want local input from advisers in Luxembourg on how the host regulator approaches outsourcing to the group.

What the case means for payment, e-money and crypto firms using group services

The lesson for any EU licensed payment, e-money or crypto business that relies on a parent or sister company is that the licensed entity must own its safeguarding, with people on the ground who understand and test it, whatever the group's operating model. The Central Bank's findings translate into a practical checklist:

• Local ownership. Appoint a named individual in the licensed entity responsible for daily safeguarding and reconciliation sign-off, with the expertise to challenge the group service provider.
• Independent testing. Make sure second and third line testing of outsourced safeguarding controls is not simply performed by the same group provider that runs them.
• Account titling. Check that every account receiving customer funds is in the licensed entity's own name, including emergency or contingency accounts opened during market stress.
• Data integrity. Treat any change to the data or reports used to calculate the safeguarding requirement as a controlled change, with reconciliation testing before and after.
• Legacy routes. After a migration, restructuring or licence change, confirm that customers can no longer pay into old accounts, and test it.
• Authorisation file. Keep a live comparison of the safeguarding model described in the authorisation application against how it actually works, and notify the regulator before material changes.

The direction of travel is towards more scrutiny of group arrangements, not less. In September 2026 the European Banking Authority published final guidelines on third-party risk management for non-ICT services, which will repeal its 2019 Guidelines on outsourcing arrangements once they apply. Firms operating in or into the UK face separate rules, covered in our guide to whether crypto firms need FCA authorisation, and specialist risk management advisers can help map outsourcing dependencies before a supervisor does.

When to bring in a financial regulatory adviser

Firms should take specialist advice as soon as they find a gap between their safeguarding model and what the rules or their authorisation file require, because the Central Bank expects immediate notification and treats self-reporting and prompt remediation very differently from problems it finds itself. Advice is particularly valuable when a firm is preparing a safeguarding audit, responding to a risk mitigation programme, restructuring group outsourcing, moving a licence between member states or negotiating a settlement under the Administrative Sanctions Procedure.

The Corporate INTL directory lists banking and finance lawyers and advisers who handle payment and e-money licensing, regulatory lawyers experienced in investigations and enforcement, and insolvency and restructuring specialists who can advise on how safeguarded funds are treated if a firm fails. Readers can also browse legal and business advisers in Ireland. To be put in touch with a suitable member, describe the matter in the "Looking for legal or business advice?" enquiry form on this page and the Corporate INTL team will help find the right adviser.

Frequently asked questions

Why was Coinbase fined?

The Central Bank of Ireland fined Coinbase Ireland Limited €3,252,618 on 22 October 2026 for breaching the Electronic Money Regulations 2011 between November 2020 and August 2025. It over-relied on its US parent for safeguarding, mixed customer funds with other Coinbase entities' funds, underfunded its safeguarding account and failed to notify material changes.

How much was Coinbase Ireland fined?

The Central Bank set the penalty at €4,646,597 and applied a 30% settlement discount, giving a fine of €3,252,618, roughly $3.6 million, together with a reprimand. Coinbase Ireland accepted the sanctions, which take effect only after the High Court confirms them.

Did Coinbase customers lose any money?

No customer loss has been reported. Coinbase said no customer suffered financial loss or was unable to access funds, and the Central Bank found no evidence that customer detriment was realised. The regulator's concern was that customers may not have recovered their funds promptly and in full had the firm become insolvent.

What does safeguarding funds mean?

Safeguarding means protecting customer money received by a payment or e-money firm so it can be returned if the firm fails. In Ireland, firms must either keep users' funds segregated, in a separate account at a credit institution or in secure low-risk assets, or cover them with insurance or a guarantee from outside the group.

What is an e-money institution?

An e-money institution is a firm authorised to issue electronic money, a stored digital value accepted as payment, in exchange for funds, and to redeem it on request. In Ireland they are authorised by the Central Bank under the Electronic Money Regulations 2011 and can passport their services across the European Economic Area.

What is a safeguarding bank account?

A safeguarding account is a segregated bank account, held in the e-money or payment firm's name, that contains only customers' funds and none of the firm's own money. Irish law prevents liquidators and creditors from claiming funds held in it, which is why underfunding or mixing undermines customer protection.

Is this Coinbase's first fine in Ireland?

No. In November 2025 the Central Bank fined Coinbase Europe Limited €21,464,734 for anti-money laundering transaction monitoring failures, after over 30 million transactions were not properly monitored. The High Court confirmed that sanction on 12 January 2026. The October 2026 case concerns a different group company, Coinbase Ireland Limited.

What happens if the High Court does not confirm the fine?

The High Court will confirm a settled sanction unless it is satisfied the sanction is manifestly disproportionate. If it declines, the matter is sent back to the Central Bank and Coinbase Ireland to reconsider, together with any recommendation the court makes about what should be looked at again.

Who is regulated by the Central Bank of Ireland?

The Central Bank authorises and supervises financial firms in Ireland, including banks, insurers, investment firms, funds, payment institutions and e-money institutions. It can impose sanctions, including reprimands and fines, under the Administrative Sanctions Procedure for breaches of designated financial services legislation such as the Electronic Money Regulations 2011.

Sources

1. Central Bank of Ireland: The Central Bank takes enforcement action against Coinbase Ireland (22 October 2026)
2. Central Bank of Ireland: Settlement Notice to Coinbase Ireland Limited (21 October 2026)
3. European Communities (Electronic Money) Regulations 2011, S.I. No. 183 of 2011, Irish Statute Book
4. Central Bank of Ireland: Enforcement action against Coinbase Europe Limited for anti-money laundering failures (6 November 2025)
5. Central Bank of Ireland: Administrative Sanctions Procedure Guidelines (December 2023)
6. Central Bank of Ireland: Dear CEO letter, Supervisory Findings and Expectations for Payment and E-Money Firms (20 January 2023)
7. Central Bank of Ireland: Cross-Industry Guidance on Outsourcing (December 2021)
8. European Banking Authority: Guidelines on third-party risk management
9. CoinDesk: Central bank fines Coinbase Ireland $3.6 million over fund safeguarding failures (22 October 2026)
10. RTÉ: Coinbase hit with second Central Bank fine for breaches (22 October 2026)

About this article

This analysis was researched and written by The Corporate INTL Newsroom, which covers cross-border legal, regulatory and business developments for lawyers, professional advisers and financiers in over 150 jurisdictions. It has been checked against the Central Bank of Ireland's announcement and Settlement Notice, the text of the Electronic Money Regulations 2011, the Central Bank's published guidance and primary reporting. The sanctions described remained subject to High Court confirmation at the time of writing. This article is general information, not legal advice; for advice on a specific matter, consult a qualified adviser. Last reviewed 23 October 2026. For more analysis like this, visit the Corporate INTL newsroom or subscribe to Corporate INTL.